Xz: malicious code in distributed source
Résumé
Xz: malicious code in distributed source
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2024-3094 lighttpd Corrigé dans: 1.4.76-r0
- Debian DEBIAN-CVE-2024-3094 xz-utils Corrigé dans: 5.6.1+really5.4.5-1
Références
- advisory access.redhat.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- package github.com
- package github.com
- report bugzilla.redhat.com
- report bugzilla.suse.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web access.redhat.com
- web access.redhat.com
- web ariadne.space
- web arstechnica.com
- web aws.amazon.com
- web boehs.org
- web bugs.debian.org
- web bugs.gentoo.org
- web discourse.nixos.org
- web gist.github.com
- web gynvael.coldwind.pl
- web lists.debian.org
- web lists.freebsd.org
- web lwn.net
- web news.ycombinator.com
- web news.ycombinator.com
- web news.ycombinator.com
- web research.swtch.com
- web research.swtch.com
- web security-tracker.debian.org
- web security.alpinelinux.org
- web security.archlinux.org
- web tukaani.org
- web twitter.com
- web twitter.com
- web twitter.com
- web twitter.com
- web ubuntu.com
- web cisa.gov
- web darkreading.com
- web openwall.com
- web theregister.com
- web vicarius.io
- web xeiaso.net
- web blog.netbsd.org
- web openssf.org
- web binarly.io
- web kali.org
- web redhat.com
- web tenable.com